diff --git a/backend/apps/system/api/variable_api.py b/backend/apps/system/api/variable_api.py
index a7cc3730..99c30e69 100644
--- a/backend/apps/system/api/variable_api.py
+++ b/backend/apps/system/api/variable_api.py
@@ -27,11 +27,13 @@ async def delete_variable(session: SessionDep, ids: List[int]):
 
 
 @router.post("/listAll",response_model=None, summary=f"{PLACEHOLDER_PREFIX}variable_list")
+@require_permissions(permission=SqlbotPermission(role=['ws_admin']))
 async def list_all_data(session: SessionDep, trans: Trans, variable: SystemVariable = None):
     return list_all(session, trans, variable)
 
 
 @router.post("/listPage/{pageNum}/{pageSize}",response_model=None, summary=f"{PLACEHOLDER_PREFIX}variable_page")
+@require_permissions(permission=SqlbotPermission(role=['ws_admin']))
 async def pager(session: SessionDep, trans: Trans, pageNum: int, pageSize: int,
                         variable: SystemVariable = None):
     return await list_page(session, trans, pageNum, pageSize, variable)